How to Audit SSH Server Configurations for Security Vulnerabilities Using the Book of Secret Knowledge

You can audit SSH server configurations for security vulnerabilities using two curated tools from The Book of Secret Knowledge: ssh-audit for cryptographic analysis and ssh_scan for policy compliance checks.

The Book of Secret Knowledge repository by trimstray collects battle-tested open-source utilities for system administrators. Auditing SSH server configurations for security vulnerabilities becomes straightforward when you leverage the ssh-audit and ssh_scan tools catalogued in the project's README.md under the CLI Tools chapter.

Essential Tools for SSH Security Auditing

The repository highlights two distinct utilities that cover complementary aspects of SSH hardening.

ssh-audit – Cryptographic Scanner

ssh-audit performs comprehensive analysis of SSH protocol implementations. According to the source code listing in README.md, this tool inspects protocol versions, ciphers, MACs, key exchange algorithms, and host-key algorithms to identify deprecated or weak cryptographic primitives.

Run a basic audit against any host:

ssh-audit example.com

For integration with monitoring systems, generate structured output:

ssh-audit --json example.com > ssh-audit-report.json

ssh_scan – Policy Compliance Checker

ssh_scan focuses on configuration-level security policies rather than cryptographic details. As documented in the repository's CLI Tools section, this utility validates settings such as AllowUsers, PermitRootLogin, and PasswordAuthentication against security baselines.

Execute a policy scan with:

ssh_scan -t example.com

The -c and -p flags allow customization of which compliance checks execute against your sshd_config.

Step-by-Step SSH Audit Workflow

Follow this systematic approach to evaluate your SSH posture using the tools from The Book of Secret Knowledge:

1. Install the required utilities

   # ssh-audit (Python-based)
   
   python3 -m pip install ssh-audit
   
   # ssh_scan (Go-based binary)
   
   curl -L https://github.com/mozilla/ssh_scan/releases/latest/download/ssh_scan-linux-amd64 -o /usr/local/bin/ssh_scan
   chmod +x /usr/local/bin/ssh_scan

2. Perform cryptographic reconnaissance

   ssh-audit myserver.example.com

   Review the output for SSH version banners, supported key exchange algorithms, and cipher suites. Flag any entries marked as deprecated.

3. Generate machine-readable reports

   ssh-audit --json myserver.example.com > audit.json

   JSON output enables automated parsing in CI/CD pipelines.

4. Validate security policies

   ssh_scan -t myserver.example.com

   This checks configuration directives like PermitRootLogin=no and PasswordAuthentication=no.

5. Consolidate findings

   ssh-audit --json myserver.example.com > crypto-audit.json
   ssh_scan -t myserver.example.com -o json >> policy-audit.json
   jq '.' policy-audit.json

6. Remediate and restart

   Edit /etc/ssh/sshd_config to disable weak algorithms and enforce strict policies. Apply changes with:

   systemctl restart sshd

Analyzing SSH Configuration Output

Understanding the audit results requires parsing both cryptographic strength and configuration compliance.

Detecting Weak Algorithms

Filter ssh-audit output to isolate vulnerable ciphers immediately:

ssh-audit myserver.example.com | grep -i "weak"

Weak algorithms typically include small key sizes or deprecated hash functions that the tool flags automatically.

Validating Security Policies

Check for dangerous configuration patterns like root login allowance:

ssh_scan -t myserver.example.com | grep "PermitRootLogin"

Violations appear when the server permits direct root access or password authentication, requiring immediate sshd_config adjustments.

Automating Audits with JSON Output

For infrastructure-as-code environments, parse audit results programmatically:

import json
import subprocess
import sys

host = sys.argv[1]
result = subprocess.check_output(["ssh-audit", "--json", host])
data = json.loads(result)

# Flag deprecated ciphers below 128-bit strength

weak_ciphers = [c for c in data["ciphers"] if c["strength"] < 128]
if weak_ciphers:
    print("Critical: Weak ciphers detected:", weak_ciphers)
    sys.exit(1)

This approach integrates SSH auditing into deployment gates, preventing servers with vulnerable configurations from reaching production.

Summary

• ssh-audit evaluates cryptographic implementations including ciphers, MACs, and key exchange algorithms in README.md's CLI Tools section.
• ssh_scan validates sshd_config policies such as PermitRootLogin and PasswordAuthentication settings.
• Both tools support JSON output (--json for ssh-audit, -o json for ssh_scan) for automated security pipelines.
• Installation methods vary: ssh-audit requires Python pip, while ssh_scan distributes pre-compiled Go binaries.
• Remediation involves editing /etc/ssh/sshd_config and restarting the SSH service after audit completion.

Frequently Asked Questions

What is the difference between ssh-audit and ssh_scan?

ssh-audit analyzes cryptographic implementations, detecting weak ciphers, deprecated MACs, and protocol version vulnerabilities. ssh_scan focuses on configuration file compliance, verifying that sshd_config directives like PermitRootLogin=no and AllowUsers restrictions are properly enforced. Use both together for comprehensive coverage.

Where are these tools documented in the Book of Secret Knowledge?

Both utilities appear in the CLI Tools chapter of README.md. The ssh-audit entry details Python installation and cryptographic scanning capabilities, while the ssh_scan entry covers Go-based policy compliance checking against Mozilla's security guidelines.

Can I automate SSH auditing in CI/CD pipelines?

Yes. Both tools support machine-readable output formats. Run ssh-audit --json and ssh_scan -o json to generate structured data, then parse results with Python or jq to fail builds when servers expose weak algorithms or violate security policies.

How do I remediate weak cipher findings?

Edit /etc/ssh/sshd_config to remove vulnerable algorithms from Ciphers, MACs, and KexAlgorithms directives. Add explicit restrictions like Ciphers [email protected],[email protected]. Validate changes with sshd -t, then restart the service using systemctl restart sshd and re-run the audit to confirm hardening.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}